LIPAS III PWS Draft for RFI.pdf

LIPAS Phase III VA-26-00007819

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY

NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Life Insurance Policy Administration System (LIPAS) Phase III

Date: 10/16/2025

VA-26-00007819

Task Order PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 APPLICABILITY

3.2 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL OR SPECIAL REQUIREMENTS

4.4 CONTRACT MANAGEMENT

4.5 GOVERNMENT FURNISHED PROPERTY

4.6 SECURITY AND PRIVACY

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 CONTRACTOR PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 Onboarding

5.1.5 VA Mandatory Training

5.1.6 WEEKLY STATUS MEETING

5.2 SUSTAINMENT SERVICES (BASE PERIOD)

5.2.1 APPLICATION SUSTAINMENT SUPPORT

5.2.1.1 EXL Licenses

5.2.1.2 SmartComm Licenses

5.2.2 PRODUCT COMPLIANCE

5.2.3 DEVSECOPS SUPPORT AND MAINTANCE SERVICES

5.2.4 HELP DESK SUPPORT

5.2.5 TRAINING MATERIALS FOR CHANGES

5.2.6 BATCH JOBS AND MONITORING

5.2.7 Maintenance Upgrades

5.2.8 Backup and Restore

5.3 Agile Development and Enhancement Scrum Team

5.3.1 Planning and Elaboration Services

5.3.2 Development & Enhancement Services

5.3.3 Integration and Testing Support Services

5.3.4 Implementation Services

5.4 OPTION PERIOD 1

5.5 OPTION PERIOD 2

5.6 OPTION PERIOD 3

5.7 Option Period 4

5.8 OPTIONAL TASK 1 - ADDITIONAL SUSTAINMENT SUPPORT

5.9 OPTIONAL TASK 2 – ADDITIONAL AGILE development and Enhancement

TEAMS

5.10 Optional Task 3 – Base Product Enhancements

5.11 Optional Task 4 – System Expansion

5.12 Optional Task 5 – Cloud Migration

5.13 Migration Planning

5.13.1 DEVELOPMENT

5.13.2 IMPLEMENTATION

5.13.3 TESTING AND VALIDATION

5.13.4 OPERATE AND MAINTAIN

5.13.5 MONITOR PERFORMANCE AND REPORTING

5.14 OPTIONAL TASK 5 – TRANSITION SUPPORT

6.0 GENERAL REQUIREMENTS

6.1 PERFORMANCE METRICS

6.2 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY

(ICT) STANDARDS

6.2.1 COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

6.2.2 ACCEPTANCE AND ACCEPTANCE TESTING

6.3 SHIPMENT OF HARDWARE OR EQUIPMENT

6.4 ENTERPRISE AND IT FRAMEWORK

6.5 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS 37

6.5.1 EPEAT

6.5.2 ENERGY STAR

6.5.3 FEMP

APPENDIX B

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Product Delivery Service (PDS) Office, Benefits and Memorials Services (BAM) Portfolio mission is to deliver world-class, innovative systems that ensure reliable, secure, and seamless delivery of benefits and services directly to Veterans and their families. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals. OI&T/PDS/BAM provides technical expertise and support to the Insurance Service and Operations Center to support them in providing our Nation’s Veterans, Service members, and Military Families insurance products and services.

The VA Insurance Service offers valuable insurance benefits that provide Veterans with peace of mind and beneficiaries with financial security. The Insurance Service is responsible for the administration of seven government life insurance programs which provide $1.5T in total coverage to 5.5 million Veterans, Service members, and their families.

Insurance Service uses the Life Insurance Policy Administration Solution (LIPAS), which has been branded “VISION”, to maintain and manage Veteran life insurance policies, including managing insurance policyholder records, processing new Insurance applications, performing policy maintenance actions, processing insurance claims, distributing payments, and generating correspondence to policyholders and their beneficiaries.

LIPAS/VISION is powered by a suite of software including EXL LifePro, LifePro Digital Suite, and SmartComm. The environments are hosted in the VA’s Enterprise Cloud

(VAEC).

In order to continue providing Veterans with the world class service they deserve;

Insurance must further modernize and enhance the current LIPAS/VISION to ensure a sustainable solution that supports the efficient operation of Insurance Service. This includes enhancements to LIPAS that will increase automation and leverage Artificial Intelligence (AI) to increase efficiencies.

The current LIPAS/VISION solution relies too heavily on manual intervention, including manual processing, correspondence, and system monitoring. Insurance Service’s objective is to incorporate a higher level of automation and Artificial Intelligence (AI) into these operations. Insurance Service aims to automate as many processes as possible, including automatic approval of insurance applications, claims, and customer requests.

This approach will alleviate the workload on Insurance staff while improving the timeliness and accuracy of applicant processing, claim processing, and other policy administration tasks. Additionally, the Insurance Service seeks to implement enhanced communication options, such as automated email and text messaging. Currently, system monitoring relies too heavily on manual checks. Insurance Service requires automated checks, reports, and notifications to assure the system is performing at a reliable level, around the clock, and that any issues in system performance immediately alerts appropriate staff and/or systematically addresses common issues.

Insurance Service requires an agile development program to collaborate with its business subject matter experts to develop enhancements, increase automation, implement AI, improve processing with added efficiencies, and integrate with both internal and external systems. All changes must be documented, thoroughly tested, and approved through a change control board.

Insurance Service has an operational need to further modernize and sustain the current solution to support the continued efficient operation of the Insurance Service. The Operation and Maintenance of LIPAS is essential not only to ensure the availability of insurance records and benefits, but to ensure that insurance policies and claims are accurate, efficient, and secure. Sustainment will provide the ability to perform routine, preventative, predictive, scheduled, and unscheduled actions aimed at preventing system/production failure and correcting software defects with the goal of increasing efficiency and reliability on a continuous basis.

Insurance Service requires a sustainment program and service level agreement to ensure optimal system availability and performance during business hours, prompt resolution of reported help desk incidents and requests, as well as reliable afterhours operations to execute and monitor daily cycle processing, batch processing, and data transmissions with external interface partners to ensure successful overnight processing.

The business need for this solution is to meet Insurance Service’s mission, to provide our Nation’s Veterans, Servicemembers, and Military Families insurance products and services, and vision to be the world-class leader for Veteran and Military insurance delivery; where a diverse and caring workforce thrives, online technology advances efficiency, and our performance honors military service by exceeding expectations for value, timeliness, and customer service.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. 38 U.S.C Legislation and applicable Regulations for administration of VA Life Insurance.

3.0 SCOPE OF WORK

The Contractor shall provide enhancements, sustainment, and license management of the overall LIPAS Solution. Enhancements include implementing Artificial Intelligence (AI) to automate business processes and modernizing interfaces with other VA enterprise systems.

3.1 APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) the T4NG Basic

PWS.

4.1.6 Program Management Support

4.8 Operation and Maintenance (O&M)

4.8.2 Application Support

4.8.7 Service/Help Desk/Call Center Support

4.8.9 License Maintenance

4.9 Cyber Security

4.9.1 Information Assurance (IA)

4.9.3 Assessment and Authorization (A&A)

4.10 Training

3.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

Travel in support of this contract will be on a Cost Reimbursement (CR) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The PoP shall be 12 months from date of award with four 12-month option periods.

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings through the PoP.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence and approval by the COR. Travel and per diem shall be reimbursed in accordance with FTR. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice. Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized on a case-by-case basis and must be pre-approved by the COR.

The total estimated number of trips in support of the program related meetings for this effort is 6. anticipated locations include the following, estimated at 2 < days per trip in duration:

1. Insurance Service Office – Philadelphia, PA

4.4 CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort.

This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

4.5 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner);

upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. 30 developer grade laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

4.6 SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low Risk Tier 2 / Moderate Risk

Tier 4 / High Risk

5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall use an Agile DevSecOps approach to continuously deliver value across the LIPAS/VISION product to provide greater user visibility, clearly defined technical infrastructure, improved capabilities, as well as information security and accessibility as directed by VA Stakeholders. The Contractor shall provide expertise and support for Products and Software. The Contractor shall provide product performance management and Agile program management to improve quality and performance of features and value delivery. The Contractor shall provide support for centralized OIT intake and management of business and technical needs and requirements. The Contractor shall provide architecture support and design reviews to support operational value streams and all activities that span product objectives.

The Contractor shall comply with IT Development Security Operations (DevSecOps) methodologies for LIPAS in accordance with the working principles and definitions provided in Section 5.0. The Contractor shall provide dedicated teams of cross-functional staff to operate, maintain, and enhance the LIPAS/VISION platform and all associated interfaces with capabilities to streamline systems, improve scalability, increase availability of services, and enable more efficient delivery.

5.1 CONTRACTOR PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver within fourteen (14) days following contract award, a detailed Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP and all subsequent updates shall be coordinated with the OI&T PM and approved by the COR and updated in accordance with Section B of the TO. The Contractor shall keep the CPMP updated and maintain the VA Program Manager (PM) approved CPMP throughout the PoP, if no updates are made, the Contractor must provide a response indicating as such. At a minimum, the following items shall be incorporated into the

CPMP:

• Change Control Support

• Configuration Management

• Integrated Master Schedule (IMS)

• Quality Management

• Requirements Management

• Risk Management

• Staffing Plan/Organization Structure

• In-Processing Plan

• Onboarding Plan

• Subcontractor Management Plan

• Technical/Management Plan

• Training Plan

• Work Breakdown Structure (WBS)

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The contractor shall track all requirements, development progress, testing, defects, releases, approvals, risks and issues in the VA approved project tracking tool, (ie. Jira).

The contractor shall leverage Jira as appropriate for real time project reporting, including the use of dashboards, sprint boards, and test plans. The contractor shall follow protocols outlined by the BAM Jira Guild, including implementing the Jira Hierarchy, to assure that BAM leadership is provided with accurate and timely Insurance reporting. If Jira is replaced by a new VA approved project tracking tool, these requirements shall apply to the implementation and management of the new toolset.

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the:

a. Contracting Officer (CO), as the Post-Award Conference Chairperson,

b. VA PM, as the Co-Chairperson,

c. Contract Specialist (CS), and

d. Contracting Officer’s Representative (COR).

The Contractor shall provide a draft agenda to the CO, COR, and VA PM at least five

(5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees.

During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation.

At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the LIPAS Phase III.” The Contractor shall submit the final updated presentation to the CO and VA PM for review and signature within three (3) calendar days after the meeting.

The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

5.1.4 ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities and providing it in an Onboarding Status Report.

Deliverable:

A. Onboarding Status Report

5.1.5 VA MANDATORY TRAINING

The Contractor and VA Project Manager (PM) shall determine which team members require access to the VA network and Jira/GitHub. All personnel that require access shall complete all the required VA Talent Management System (TMS) training courses prior to Kickoff meeting. The Contractor shall work with its respective point of contact, to obtain access to TMS to complete the mandatory training courses. As an action under the Continuous Readiness in Information Security Program (CRISP), VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA Government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness (PISA), Rules of Behavior (ROB), Health Insurance Portability and Accountability Act (HIPAA), and Role-Based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

Deliverables:

A. TMS Training Certificates for all Mandatory Training

Keen-deputy, Christine M.

We don’t need to include these as deliverables.

B. Signed Contractor Rules of Behavior

5.1.6 WEEKLY STATUS MEETING

The Contractor’s PM shall participate in and facilitate weekly update meetings. Weekly meetings shall be set up after the kickoff meeting and in advance, considering availability of Government Program Management Office (PMO) staff, providing phone dial-in and/or teleconferencing or web conferencing. An agenda shall be provided prior to the meeting. The Contractor shall facilitate the meeting, track action items, describe any risks associated with performance, schedule, or other concerns during this meeting, and deliver meeting minutes following the meeting. Meeting minutes shall include current statuses of all open issues and any upcoming service development and service implementation activities.

The Contractor shall include, at minimum, the following topics:

• Highlight accomplishments

• Quality status

• Production Schedule status

• Staffing status

• Risk Management

• Plans for coming weeks (including performance improvement plan/remediation plan efforts)

• All action items (status (pending, closed, other), duration, and resource assignments)

• Contractor corporate/resource email distribution list with updates monthly

• Deliverable status

The Contractor shall capture, track, and report action items and risks weekly. Capturing, tracking, and reporting shall be electronic via a Government approved enterprise change management, risk/issue tracking tool (e.g. JIRA, or similar). The Contractor is not required to develop and implement a new tracking tool to satisfy this requirement.

Use of an existing solution is acceptable so long as the tool meets the following minimum requirements, and its use is approved by the Government PM:

• Action items and risks are organized and enumerated

• The tool displays the metadata related to each action item/risk

Access to the tool shall be granted to the Government PM and any other Government resource(s) or agents of the Government identified by the PM. Access includes the ability for Government resources to run reports as necessary to track action items, risks, defects, etc.

5.2 SUSTAINMENT SERVICES (BASE PERIOD)

The Contractor shall provide support to the LIPAS system regarding to the performance and optimization of routine, preventive, predictive, scheduled, and unscheduled actions aimed at preventing system/production failure (i.e., break/fix) and correcting application/system defects with the goal of increasing efficiency and reliability on a continuous basis to optimize performance.

The Contractor shall provide LIPAS system operations support and maintenance of the licenses by working and coordinating with the Government Subject Matter Experts (SME(s)) for timely execution of all license management aspects. The Contractor shall provide licenses, maintenance, subscriptions, and professional services paid for under this contract, to include detailed information regarding terms, and pricing.

In support of these activities, the Contractor shall configure, maintain, test, and deploy maintenance releases for each application, as well as provide help desk support, and training as detailed in PWS Section 5.2.1 – 5.2.8. Each Contractor team shall be comprised of the appropriate distribution of cross functional roles with the requisite mix of labor categories, experience, skills and expertise to execute Agile DevSecOps services to provide sustainment support Insurance Products across all environments.

LIPAS applications/systems require support from 7:00AM to 6:00PM EST, Monday through Friday except for federal holidays.

The Contractor shall have available to VA three (3) categories of team sizes to perform the sustainment requirements as described in the Section 5.2 for each application/system. The required full-time employee (FTE) count for each team size are as follows:

Required Team Sizes Application/System Dedicated FTEs per Team

Extra Small (XS) 1-4 Small (S) 5-9 Medium (M) 10-14

For the base and option periods (if exercised), the Contractor shall provide one Medium Team to perform the sustainment activities for LIPAS in accordance with section 5.2 and its subsections. Additional Sustainment Teams may be exercised throughout the base and Option Periods at the Government’s discretion per Optional Task 1 at PWS Section 5.8.

5.2.1 APPLICATION SUSTAINMENT SUPPORT

The Contractor shall perform maintenance activities and implement maintenance upgrades to the LIPAS system, but not limited to, testing, deployment, production, and configuration management support.

The Contractor shall comprehensively support the operations, sustainment, maintenance, security, accessibility, performance, core services, technical standards, architectural compliance, operational capability testing, audits and reviews, integration with external systems, triage and resolution support of issues, monitoring, contingency, capacity planning, and recovery for its assigned application/system.

The Contractor shall work in concert with the VA Product Manager to achieve holistic and seamless DevSecOps sustainment support in alignment with the VA Product Line Management (PLM) Playbook and the applicable working principles outlined in Section 2.0.

The Contractor tasks include, but are not limited to:

1. Perform all operation services and activities including performance and dashboard monitoring and inclusive of job scheduling and execution, backup and restore.

2. Meet or exceed SLA targets (refer to Appendix B) for mean time to resolve issues and operational incidents.

3. Provide support to keep all environments in an operational state.

4. Support the uptime of system operations at 99.9%

5. Support software releases during weekends (day and potentially nighttime hours) and monitoring/maintenance activities periodically during weeknights.

VA estimates that regularly scheduled releases will occur quarterly or less depending on the application/system’s need. Emergency releases historically occur three (3) times a year.

6. Provide “After-Hours” support for network and external dependency tasks and to support coordinated activities and software releases. “After-Hours” requirements are rare; however, installation weekends are necessary (approximately four (4) to eight (8) times per year) and critical defects resulting in work stoppage may require support up to 24x7 until resolved.

When after-hours support is required, the Contractor shall provide the necessary staff to resolve the issue(s) to ensure the appropriate performance metrics are met again. These metrics fluctuate from system to system but generally any downtime is to be avoided.

7. Detect, diagnose, and resolve issues and operational incidents within the time frames as defined in Appendix B

8. Support VA event management processes for critical and high priority incidents (including participation in High Priority Incident (HPI) or Critical Priority Incident (CPI) and publication of After-Action Reports)

9. Maintain incident metrics and supplementary data to detect patterns and trends and facilitate rapid diagnosis of previously observed incidents.

10. Manage and track software licenses and maintenance agreements.

11. Deploy and maintain automation to detect and generate alerts for lapses in system availability and material deviations from baseline system performance.

12. Provide continuous improvement of monitoring and alerting to detect new failure points.

13. Create a Release Plan (refer to Application Release Package below) for each application release based on VA best practices as specified in the VIP Release Process Guide.

14. Monitor and acknowledge VA IT and Security Bulletins for required and recommended changes to software, authentication, encryption, security protocols.

15. Test and implement VA generated IT security alerts, mandated security patches, emergency Congressional, Court, or White House mandates as well as maintain existing VA developed code. Software must pass and get approval in all lower-environment testing, including System Integration Testing (SIT) and User Acceptance Testing (UAT), and be installed in Production, and pass post-deployment testing with no Severity 1 or 2 defects to be accepted.

16. Support UAT and perform regression-testing activities, including test case and test script development. The Contractor shall work with the Insurance representative for the application/system to ensure release code is accepted.

The Contractor shall ensure deficiency reporting is logically organized and traces the status of each identified deficiency from initial identification through acceptance testing of its correction/resolution. UAT and regression testing are required for each release.

The Contractor Shall deliver a UAT Master Test Plan to include:

a. Develop a Master Test Plan

b. Develop UAT Test Cases, test scripts, test data

c. Provide Test Manager to assist in preparation and execution of UAT.

d. Develop UAT Test Schedule

e. Develop a defect management plan.

f. Manage defect triage and management.

g. Develop and adhere to test readiness checklist.

17. Manage system performance and capacity for LIPAS.

The Contractor shall:

a. Establish a baseline for system performance and resource utilization.

b. Establish reserve capacity targets to accommodate spikes in real-time demand and organic growth.

c. Work with the VA OIT PM to identify “key” business transactions for monitoring / optimization purposes.

d. Formulate and execute strategies to maintain desired reserve capacity.

e. Conduct periodic reviews of current and forecasted system performance and resource utilization.

The Contractor shall follow Process Asset Library (PAL) artifacts templates and develop a LIPAS Release Package for each application release.

The Application Release Package includes:

a. Release Plan

b. System Design Documentation

c. Comprehensive Test Plan

d. Use Cases and Test Cases Documentation

e. Unit, Integration, and Regression Testing Reports

f. User Acceptance Testing Reports

g. Technical Release Notes

h. Release Code and Technical Documentation

i. User Guide

j. Data Dictionary

k. Production Environment Deployment and Rollback Procedures

The Application Release Package shall also detail resolutions of failed data conversion efforts, expected time durations for recovery and any time critical decision points prior to any change being scheduled. The Contractor shall provide updates to the LIPAS Release Packages based on the application/systems’ specific release schedule and communicate any potential changes for each release with the VA PM, COR, Office of Performance Analysis and Integrity (PA&I), and Business Stakeholders. The VA will provide a single authoritative project and product artifact repository 10 days after contract award.

Deliverables:

A. UAT Master Test Plan B. Application Release Package C.

D.

5.2.1.1 EXL LICENSES

The contractor shall maintain and manage all required EXL licenses and maintenance agreements required to sustain and enhance LIPAS.

5.2.1.2 SMARTCOMM LICENSES

The contractor shall maintain and manage all required SmartCOMM licenses and maintenance agreements required to sustain and enhance LIPAS.

5.2.2 PRODUCT COMPLIANCE

In support of LIPAS application/system product compliance, the Contractor shall:

1. Support Field Security Services Information Security Officers and the Office of Cyber Security Control Assessment team as detailed in VA Directive and Handbook 6500 Information Security Program, VA Handbook 6500.3 Certification and Accreditation of VA Information Systems.

2. Conduct cybersecurity software code quality testing and validation of all

If there are tangible deliverables for these 2 items, the narrative in the text of this section has to address them specifically by name.

software code and provide certified scan reports validating the required code quality to the maximum extent possible.

3. Conduct and participate in vulnerability scans and tests as detailed in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 4 Recommended Security Controls for Federal Information Systems and Organizations, if/when requested by the COR or System Owner.

4. Create, verify, and upload required documents to the VA approved Risk Management tool ( e.g. Enterprise Mission Assurance Support Service [eMASS, or ServiceNow])

5. Manage and ensure vulnerability remediation status and perform tracking with a VA-provided tool (e.g.,. Information Central Analytics and Metrics Platform [ICAMP])

6. Provide support with the VA Approved Risk Management tool (e.g. eMASS or ServiceNow), applicable documentation, and coordinate with data center partners to ensure consistency with all VA Authority to Operate (ATO) requirements for certification to ensure the Product Line meets VA’s information security policies and standards to ensure the successful completion of the Assessment and Authorization (A&A) process and obtain an

ATO.

7. Perform security scanning by multiple methods, multiple times throughout the course of a project utilizing methods such as infiltration testing (WASA, Penetration Tests), code analysis tools (Fortify), etc.

8. Perform Web Accessibility (Web Application Security Assessment [WASA]) scans in compliance with the top Open Web Application Security Project

[OWASP]

9. Perform Vector Penetration (Pen-Tests)

10. Remediate critical and high vulnerabilities within required time frames based on severity (critical=30 days, high=60 days, medium=90 days) after identification in government scans or quality checks or reviews/audits.

11. Provide vulnerability scanning reports and assessments as detailed in NIST SP 800-30 Rev 1 Guide for Conducting Risk Assessments.

12. Create Plan of Actions and Milestones (POAM) for any finding or vulnerability that cannot be addressed or remediated within required time frames based on Severity.

13. Identify, document, review, and maintain the A&A Artifacts as needed to support an ATO request in accordance with VA policy and Federal Law and guidelines, as detailed in NIST SP 800-37 Rev 1 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Additionally, the Contractor shall update Product documentation based on comments from the A&A review process conducted.

The Contractor shall provide an Updated A&A Package for LIPAS which consists of, but is not limited to, the following A&A artifacts:

a. System Security Plan (SSP)

b. Security Configuration Plan (SCP)

c. Security Configuration Management Plan (CMP)

d. Information System Contingency Plan (ISCP) to include Business Impact Assessment (BIA)

e. Incident Response Plan (IRP) and Test

f. Privacy Impact Assessment (PIA)

g. Privacy Threshold Analysis (PTA)

h. Risk Assessment (RA)

i. Security Configuration Checklist (SCC)

j. Memorandum of Understanding (MOU) and Interconnection Security

Agreement (ISA)

k. Signatory Authority (SA)

l. Disaster Recovery Plan (DRP)

m. Database Scan Vulnerability Remediation Plan

n. Plan of Action and Milestones (POAMs)

o. Section 508 Compliance

14. Provide Support as needed for security and non-security audits

15. Facilitate Assessment and Authorization (A&A) activities, including:

a. Attaining and maintain an ATO

b. Supporting auditing activities (eg. OIG, FISMA, periodic Security

Controls Assessments, etc.)

c. Ensuring compliance with applicable laws, regulations, and standards, including providing evidence of compliance upon request. (See Section

2.0 Applicable Documents)

Deliverables:

A. A&A Artifacts.

5.2.3 DEVSECOPS SUPPORT AND MAINTANCE SERVICES

The Contractor shall provide DevSecOps and maintenance support, as applicable to the Product as follows:

1. Incorporate Configuration management to support the development methodology in all environments.

2. Build, deliver, and maintain DevSecOps pipelines for implementing CI/CD for cloud applications.

3. Automate all phases of software delivery via an instance of CI/CD pipeline delivered from an enterprise pipeline framework. The phases shall support functional and regression testing, including test data conditioning, and incorporate, at a minimum:

• Automated Unit Testing

• Automated Builds

• Automated Functional Testing

• Automated Performance Testing

• Automated Resiliency Testing

• Automated Section 508 Compliance Testing

• Automated Static and Dynamic security Testing (e.g. Fortify)

• Automated zero downtime deployments

• Automated rollback

• Automated deployment validation

4. Develop, deliver, and maintain CI/CD environments.

5. Develop and maintain a CICD procedure to support multiple technology stacks including (but not limited to) Java, JavaScript frameworks, SQL, Python, Bash.

6. Develop and maintain a CI/CD procedure to ensure that the application meets the security standards set by the enterprise and referenced in section 5.2.2 and 5.2.3 of this PWS

7. Develop and maintain a CI/CD following Infrastructure as Code principles and ensure that all physical resources adhere to cloud compliance standards set by the Enterprise.

8. Develop and maintain a CI/CD procedure to support end-to-end business processing and automated testing to support Test Driven Development (TDD) methodologies.

9. Capture metrics from the CI/CD pipeline for each application to demonstrate compliance with DevSecOps and performance metrics.

10. Provide administrative support functions for product application and COTS products (eg. Application server, web server, content server, etc.) and middleware platforms like WebLogic and web servers like Apache.

11. Provide administrative support for Windows and Linux systems.

12. Identify and institute metrics to measure DevSecOps maturity and automate the collection of the same.

13. Manage Government approved cloud services and resources including creating and maintaining comprehensive Product environments in the Government Cloud, such as Dev, SQA, Pre-Prod, Production.

• Apply OS and application patches

• Monitor certificate and token expiration dates (and renew / update certificates accordingly)

• Monitor middleware / COTS / Open-source software releases and schedule required upgrades.

14. Define, develop, and deliver Monitoring and DevSecOps Dashboards.

15. Deliver dashboard metrics at the regular agreed upon cadence including the following data:

• Release cadence and percent of automated releases

• Percent automated test coverage across all testing phases

• Downtime incurred during deployments

• Release Failure Rate

• Lead time

• Meantime to restore

• Successful automated rollbacks

• Percentage of time system meets or exceeds performance, capacity, and availability targets.

16. Define, develop, and deliver application monitoring plan, including dashboards.

17. Define, develop, and deliver Automated Testing Reports.

18. Perform activities associated with responding to incident, reporting defects, and analyzing, designing, developing, implementing, and maintaining minor functional and/or technical enhancements, and/or infiltrating and applying refactoring to applications in production to improve the performance and/or stability of an application.

19. Perform activities required for providing, maintaining, securing, scheduling, backing up, recovering, and supporting the Product environments.

20. Develop, delver, and maintain the Product Interface Control Document

(ICD)

Deliverables:

A. Automated Testing Reports B. Product Interface Control Document

5.2.4 HELP DESK SUPPORT

The Contractor shall provide Tier Two and Tier Three help desk support for the Insurance application. The VA National Service Desk (NSD) will provide Tier One support. Tier Two and Tier Three support shall be provided by the Contractor after tickets are issued from the NSD. The Contractor resolve Tier Two and Tier Three trouble tickets and shall close each ticket in the NSD.

Tier Two and Tier Three help desk support shall be available from 7:00 AM to 6:00 PM Eastern Standard Time, Monday through Friday except for federal holidays. The Contractor shall provide help desk ticket support in accordance with the HELP DESK SLA documented in Appendix B and summarize all activities in a Monthly Help Desk Status Report detailed below.

The Contractor shall perform the following tasks:

• Continuously build on and enhance existing knowledge base in the VA help desk tool. The Contractor’s work includes, but is not limited to, documenting all problems, troubleshooting steps, probable solutions and librarying the communication script for the responses to users (for uniform customer service). Work also includes maintenance of materials to ensure they are accurate, current, and that they are functionally useful to VA National Service Desk Technicians and VA users.

• Provide all the necessary coordination with the VA National Service Desk, VA PM and other cross functional support teams to handle all reporting activities required for managing and resolving tickets.

• Report metrics to validate that the HELP DESK SLAs (VA has established the HELP DESK SLAs for all production applications/systems) are being met.

• Manage and update the ServiceNow Dashboards.

The HELP DESK SLA timeline will start at the moment the issue is logged. The goal will be measured monthly, calculated form the first to last day of the month.

The Contractor shall provide a monthly Help Desk Status Report which will be matured over time as part of process improvements, and shall include, at a minimum, the following:

• Description of trouble tickets and resolution

• Status of resolution

• Recommendations for code and/or procedural changes of a preventive nature and to improve the customer experience

• Number of incidents, problems, and requests

• Breakdown of incidents, problems, and requests by severity

• Percent of critical and high priority tickets

• Percent of aged tickets

• Average response and remediation times by severity

• Average time to close incidents by severity

• Total number of overdue incidents

• Number of resolutions and overdue incidents by assigned group

• Number of change orders

• Release occurrences, start time, and end time

• Number of release rollbacks and reason for each

• Number of emergency fixes

• Number of emergency fixes related to a schedule release

• Mean time between releases (scheduled and unscheduled)

• Mean time to failure

• Mean time to repair Mean time between failures

A. Monthly Help Desk Status Report

5.2.5 TRAINING MATERIALS FOR CHANGES

The Contractor shall provide Training Materials with each release. The Contractor shall ensure training materials accurately describe and effectively portray LIPAS application/system functionality to end users. Training materials shall include, but may not be limited to, instruction on application/system functionality, a user guide, including graphical user interface menu structure and navigation procedures, help resources, explanation of error messages, troubleshooting steps, and interaction with other applications/systems. The Contractor shall include in the training materials information pertinent for end users reliant on adaptive technology (Section 508 compliant) who use LIPAS applications/systems to perform their work.

Deliverable:

A. Training Materials

5.2.6 BATCH JOBS AND MONITORING

The LIPAS system currently utilizes numerous recurring batch processes and scheduled tasks to process Insurance transactions, update Insurance policies, generate letters and reports, process incoming collections files, generate outgoing payment files, and process files in support of various other system interfaces. Insurance Service requires a nightly cycle to be run every evening, consisting of numerous batch processes as well as recurring jobs running monthly on specified days of the month.

Insurance Service requires consistency and reliability in the execution of these jobs to ensure all processes run on schedule and complete successfully. Strict controls must be implemented to ensure expected input files are received on-time for processing, to prevent duplicate processing, and to ensure expected outputs are generated on-time and validated.

The Contractor shall:

• Create a master schedule of all recurring batch jobs and scheduled tasks and document the dates, times and durations when each job will be executed. The schedule shall indicate whether each job is executed manually or automated by a job scheduler. The master schedule shall be updated monthly if any changes to the schedule are made.

• Create and maintain Standard Operating Procedures (SOPs) for each batch job and scheduled task. Each SOP shall include a description of the job and its purpose, a listing of required inputs and outputs, instructions for executing the job, and steps required to handle any potential errors or exceptions.

• Create an Operations Manual for personnel responsible for the operations and maintenance of LIPAS batch processing and scheduled tasks.

• Setup and maintain monitoring for all batch jobs and report any failures to OI&T and Insurance Service within 12 hours.

Deliverables:

A: Master Schedule of all recurring batch jobs and scheduled tasks B: SOP for each batch job and schedule task C: Operations Manual

5.2.7 MAINTENANCE UPGRADES

For the solution, the Contractor shall provide all commercially available maintenance upgrades and/or patches. However, VA reserves the right whether to accept a maintenance upgrade for the proposed system. The Contractor shall notify the VA PM/COR in writing, of all upcoming maintenance upgrades within 30 calendar days of proposed implementation. Additionally, the Contractor shall document the functionality

Added to match deliverable and compatibility changes from current production system in the Production Operations Manual maintained in GitHub.

5.2.8 BACKUP AND RESTORE

The Contractor shall:

In the event of an outage, restore the system, ensuring that LIPAS is operational and accessible to users.

1. Ensure VA has access to and can recall the archived data upon request.

2. Develop and implement a Backup and Restore Plan for the solution using industry best practices. At a minimum, the Backup and Restore Plan shall include the requirement to save data for the backup and recovery of information stored on the cloud storage infrastructure to meeting related SLAs and the retention of records as required by VA Handbook 6300.1 (“Records Management Procedures”) and VA Directive 6300, (“Records and Information Management”)

Deliverable:

A. Backup and Restore Plan

5.3 AGILE DEVELOPMENT AND ENHANCEMENT SCRUM TEAM

The contractor shall provide VA with integration of Agile software development and continuous integration / continuous deployment (CI/CD). The contractor shall support the intake of business needs, prioritization, and delivery. The contractor shall support and oversee initiatives and epics through initial business need definition, prioritization, and execution. The Contractor shall provide overarching architecture support. The contractor shall identify dependencies, inputs, and outputs, the timeline for completion of integrated efforts, and processes to manage the overall integrated effort. The Contractor shall adhere to the Agile Center of Excellence (ACOE) PLM Transformation Playbook and adopt modern practices to continuously improve VA experiences through a combination of people, processes, and technology as referenced in Section 2.0, the applicable documents section of this PWS.

The Contractor shall:

1. Perform OIT approved activities required for providing business and/or IT analysis, investigation, evaluation, selection, and rollout.

2. Perform activities associated with the integration of Product services to realize strategic objectives and roadmaps. This includes incident, problem, change, and configuration management.

3. Collaborate with Agile Development teams to implement industry standards and best practices for feature toggles.

4. Provide test data required for development and test environments using established processes. Maintain and perform the repeatable process and associated scripts to mask/sanitize data when the database is refreshed from production.

5. Enable the Agile Development Teams to automate production releases by automating the change approval process when appropriate

6. Partner with the VA OIT Product Owner and Product Team to create a DevSecOps roadmap for LIPAS to achieve the maturity goals set for the organization by the Product Line

7. Participate, contribute, and support Releases.

8. Peer review the Data Definition language (DDL) and DML created by Agile

Development Teams

9. Develop, support, implement, and validate changes for other legislative changes; schedule database refreshes, apply baselines, and run scripts.

The Contractor shall provide Agile Development Teams to enable DevSecOps Product support. The Contractor shall apply an Agile scrum approach and provide cross functional Agile teams for the development and enhancements of LIPAS and the underlying infrastructures in alignment with VA’s Veteran-focused Integration Process (VIP) Guide and ACOE PLM Transformation Playbook.